LAB 2
Wireshark Lab: HTTP
1. HTTP GET/response interaction
Take exploration of HTTP by downloading a very simple HTML file - one that is very short, and
contains no embedded objects. Do the following:
1. Start up your web browser.
2. Start up the Wireshark packet sniffer. Enter “http” (just the letters, not the quotation
marks) in the display-filter-specification window to show only captured HTTP messages
in the packet-listing window.
3. Wait a bit more than one minute and then begin Wireshark packet capture.
4. Enter the following to your browser
[Link]
5. Stop Wireshark packet capture.
Print out the GET and response messages and indicate where in the message you’ve found the
information that answers the following questions.
1. Is your browser running HTTP version 1.0 or 1.1? What version of HTTP is the server
running?
HTTP version is 1.1
2. What languages (if any) does your browser indicate that it can accept to the server?
Languages : en-US.
3. What is the IP address of your computer? Of the [Link] server?
IP address of computer is 192,168.137.68.
IP address of [Link] server is [Link].
4. What is the status code returned from the server to your browser?
The status code is 200.
5. When the HTML file that you are retrieving was last modified at the server?
Last modified at the server was Thu, 14 Jul 2022 [Link] GMT
6. How many bytes of content are being returned to your browser?
1031 of content are being returned to browser.
7. How many data-containing TCP segments were needed to carry the single HTTP
response?
2 TCP segments
8. How many HTTP GET request messages were sent by your browser? To which Internet
addresses were these GET requests sent?
19 HTTP GET request messages were sent by browser to [Link].
9. How long did it take from when the HTTP GET message was sent until the HTTP OK
reply was received?
0.502599 seconds
10. Print the two HTTP messages (GET and OK).
GET
Frame 40: 490 bytes on wire (3920 bits), 490 bytes captured (3920 bits) on interface \
Device\NPF_{045865C7-F342-4CCF-970D-3A65E8F2DB16}, id 0
Ethernet II, Src: Intel_[Link] ([Link]), Dst: [Link]
([Link])
Internet Protocol Version 4, Src: [Link], Dst: [Link]
Transmission Control Protocol, Src Port: 54603, Dst Port: 80, Seq: 1, Ack: 1, Len: 436
Hypertext Transfer Protocol
GET / HTTP/1.1\r\n
[Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]
[GET / HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: GET
Request URI: /
Request Version: HTTP/1.1
Host: [Link]\r\n
Connection: keep-alive\r\n
Upgrade-Insecure-Requests: 1\r\n
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/[Link] Safari/537.36\r\n
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/
webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\n
Accept-Encoding: gzip, deflate\r\n
Accept-Language: en-US,en;q=0.9\r\n
\r\n
[Full request URI: [Link]
[HTTP request 1/3]
[Next request in frame: 54]
OK
Frame 63: 221 bytes on wire (1768 bits), 221 bytes captured (1768 bits) on interface \
Device\NPF_{045865C7-F342-4CCF-970D-3A65E8F2DB16}, id 0
Ethernet II, Src: [Link] ([Link]), Dst: Intel_[Link]
([Link])
Internet Protocol Version 4, Src: [Link], Dst: [Link]
Transmission Control Protocol, Src Port: 80, Dst Port: 54603, Seq: 9318, Ack: 870, Len:
167
[2 Reassembled TCP Segments (1547 bytes): #62(1380), #63(167)]
Hypertext Transfer Protocol
HTTP/1.1 200 OK\r\n
[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]
[HTTP/1.1 200 OK\r\n]
[Severity level: Chat]
[Group: Sequence]
Response Version: HTTP/1.1
Status Code: 200
[Status Code Description: OK]
Response Phrase: OK
Date: Sun, 11 Aug 2024 [Link] GMT\r\n
Server: Apache/2.4.41 (Ubuntu)\r\n
Content-Disposition: inline; filename="combo"\r\n
Last-Modified: Thu, 14 Jul 2022 [Link] GMT\r\n
Expires: Wed, 06 Aug 2025 [Link] GMT\r\n
Pragma: \r\n
Cache-Control: public, max-age=31104000, immutable\r\n
Accept-Ranges: none\r\n
Etag: "9b9cbb79c1192e9cb56160269e7434e0ac649341"\r\n
Content-Encoding: gzip\r\n
Vary: Accept-Encoding\r\n
Content-Length: 1031\r\n
[Content length: 1031]
Keep-Alive: timeout=5, max=99\r\n
Connection: Keep-Alive\r\n
Content-Type: text/css;charset=UTF-8\r\n
\r\n
[HTTP response 2/3]
[Time since request: 0.174643000 seconds]
[Prev request in frame: 40]
[Request in frame: 54]
[Next request in frame: 74]
[Request URI: [Link]
[Link]]
Content-encoded entity body (gzip): 1031 bytes -> 3627 bytes
File Data: 3627 bytes
Line-based text data: text/css (40 lines)
